fix(dashboard): wire data-async form submit handler on the C0R3 page

Clicking "update & rebuild" (and cancel / respawn / purge) on /core.html
navigated to the bare `ok` response page instead of submitting async. The
C0R3 page (split out of the dashboard) carries `data-async` forms but its
bundle never had the global submit interceptor — that handler lived inline
in tabs.js, so only the dashboard bundle had it. The forms POSTed natively
and the browser followed the response.

Fix: lift the `data-async` submit handler out of tabs.js into a shared
`bindAsyncForms(onSuccess)` in common.js (which already owns the `form`
helper that builds these forms), and call it from both pages:
- tabs.js: `bindAsyncForms(() => refreshState())` — behaviour-preserving
  (same handler, now imported).
- core.js: add a `refreshState()` (re-fetch /api/state + re-render) used
  for the cold load and as the post-submit refresh, and call
  `bindAsyncForms(() => refreshState())` at boot.

Forms with `data-no-refresh` (e.g. meta-update, which gets its update via
the meta SSE events) skip the refresh, same as before.

frontend/packages/dashboard/src/common.js

@@ -46,6 +46,67 @@ export const form = (action, btnClass, btnLabel, confirmMsg, extra = {}, opts =
   return f;
 };
 
+// Page-level submit interceptor for `data-async` forms — the pattern every
+// dashboard action button uses (meta-update, spawn, cancel, purge, …).
+// Without this a `data-async` form POSTs natively and the browser navigates
+// to the bare `ok` response page. Each page that renders such forms must
+// call this once at boot (dashboard via ./tabs.js, /core.html via ./core.js).
+// `onSuccess` runs after a successful submit unless the form opts out with
+// `data-no-refresh` (forms whose mutation arrives faster via an SSE event).
+export function bindAsyncForms(onSuccess) {
+  document.addEventListener('submit', async (e) => {
+    const f = e.target;
+    if (!(f instanceof HTMLFormElement) || !f.hasAttribute('data-async')) return;
+    e.preventDefault();
+    if (f.dataset.confirm && !confirm(f.dataset.confirm)) return;
+    if (f.dataset.prompt) {
+      const ans = prompt(f.dataset.prompt, '');
+      if (ans === null) return; // operator hit Cancel
+      // Drop into a hidden input named after `data-prompt-field` (or
+      // 'note' by default) so the value rides along on the POST.
+      const field = f.dataset.promptField || 'note';
+      let input = f.querySelector(`input[name="${field}"]`);
+      if (!input) {
+        input = document.createElement('input');
+        input.type = 'hidden';
+        input.name = field;
+        f.append(input);
+      }
+      input.value = ans;
+    }
+    const btn = f.querySelector('button[type="submit"], button:not([type]), .btn-inline');
+    const original = btn ? btn.innerHTML : '';
+    if (btn) { btn.disabled = true; btn.innerHTML = '<span class="spinner">◐</span>'; }
+    try {
+      const resp = await fetch(f.action, {
+        method: f.method || 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(new FormData(f)),
+        redirect: 'manual',
+      });
+      const ok = resp.ok || resp.type === 'opaqueredirect'
+        || (resp.status >= 200 && resp.status < 400);
+      if (!ok) {
+        const text = await resp.text().catch(() => '');
+        alert('action failed: ' + resp.status + (text ? '\n\n' + text : ''));
+        if (btn) { btn.disabled = false; btn.innerHTML = original; }
+        return;
+      }
+      // Re-enable the button — the refresh rebuilds most lists but skips
+      // forms that didn't change, so without this the spinner sticks.
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+      // Clear text inputs whose value was just submitted.
+      f.querySelectorAll('input[type="text"], input:not([type]), textarea').forEach((i) => { i.value = ''; });
+      if (!f.hasAttribute('data-no-refresh') && typeof onSuccess === 'function') {
+        onSuccess();
+      }
+    } catch (err) {
+      alert('action failed: ' + err);
+      if (btn) { btn.disabled = false; btn.innerHTML = original; }
+    }
+  });
+}
+
 // `truncate`, `fmtAgo`, `fmtElapsed`, `fmtDuration` + the `paintAtomic`
 // render helper live in the dashboard-internal `./util.js`, not here —
 // their phrasing ("X running", "X ago") is dashboard-specific, so they